MN 5508 Project Management Module

Assessing Risks
 MN 5508 Project Management Module

What is risk?
A probability or threat of damage, injury, liability, loss,
or any other negative occurrence that is caused by
external or internal vulnerabilities, and that may be
avoided through pre-emptive action.

www.businessdictionary.com

…or mitigated…
Professor Kai Cheng!
 MN 5508 Project Management Module

What is risk?
A probability or threat of damage, injury, liability, loss, or any other
negative occurrence

This implies a measurable Can be applied to anything presenting the

quantity possibility

that is caused by external or internal vulnerabilities,

Need to know what the vulnerabilities might be

and that may be avoided or mitigated through pre-emptive action.

Focuses on actions to reduce or eliminate the risk or the consequences

 MN 5508 Project Management Module

The management of risk is about the assessment of these criteria:

1. The external or internal vulnerabilities

What could go wrong? Consider all possibilities!

Make a list

2. What is the chance of each one happening?

For each vulnerability calculate the chances of it

happening

3. If it happens, what are the losses/consequences?

For each vulnerability calculate the loss likely to be
caused

4. Decide where actions should take place based on largest loss/highest

probability first
 MN 5508 Project Management Module

Risk management process

• Risk management planning

• Risk identification
• Qualitative risk analysis
• Quantitative risk analysis
• Risk response planning
• Risk monitoring and control
• The risk register
 MN 5508 Project Management Module

Example
I am going to build a garden shed. It will comprise a concrete base
with wooden walls and roof. I have to dig the ground for the base.
I can get the materials from many places except for the
waterproof covering for the roof and that is only available from
one supplier. I think that there is about two weeks of work for me
(I don’t want to hire labour).
What are my ‘vulnerabilities’? Make a list….

Time: Key supplier fails, foundation problems, weather,

illness, tool shortage
Costs: Materials over budget, need to hire labour, need
to hire tools, rework owing to faults
Performance: Unsatisfactory materials, inadequate skills,
ground problems
 MN 5508 Project Management Module

Note!
This categorisation of vulnerability is very similar to
the ‘iron triangle’ used to develop project
management ideas…….. the concept that practically
you cannot deliver excellent performance, budget
price and rapid time scales at the same time.
P

T C
 MN 5508 Project Management Module

Lets skip steps 2 and 3 first to see what happens. So, given the
list of vulnerabilities, what do we do about them?

Key supplier fails Check supply and secure early

Foundation problems Trial dig early to identify problems and decide
Weather Build weatherproof covers, get wet?!
Illness Have health check, avoid ill people!
Tool shortage Check tools, consider acquiring additional tools
Materials over budget Check prices and suppliers early
Need to hire labour Where (and what cost) can help be acquired?
Need to hire tools Seek costs and suppliers
Rework owing to faults Take care, purchase good materials
Unsatisfactory materials Purchase good materials
Inadequate skills Go on training course, hire skills
Ground problems Solve foundation problems properly
MN 5508 Project Management Module

What will happen to the time scale, budget and

performance if we considered all of these
actions as necessary? Is it justified to take all
of these precautions? Which actions are going
be sensible? How do we prioritise?

We need a way to identify the

likelihood of these happening and
decide what RISK we want to take!
 MN 5508 Project Management Module

Simple assessment based on qualitative factors:

Probable

Likely?

Not very
Few Dire
Consequences
 MN 5508 Project Management Module

Probable 2 1

Assessment for
9
5 6 me and my
Likely? 7 3 approach only!

Not very 8 4
Few Dire
Consequences
I am going to repair my car. The brakes are rusty and I want to change the disks.
Put on the graph above an assessment of the following possibilities:
1.The car falls off the jack while I am under it; 2. The bolts are rusted in and I
have to purchase a complete new assembly; 3. I make a mistake in reassembling the
brakes; 4. The new disks are faulty; 5. I bruise my hands when the tools slip; 6. I
get halfway through and realise I don’t have the tools or skills to complete the job;
7. I breathe in possibly toxic dust; 8. I get very dirty; 9. The job takes longer than
I thought and I cant use my car for this time.
MN 5508 Project Management Module

This is a simple assessment used when it is very

difficult/uneconomic to calculate probabilities
and/or losses if an event happens. It is often
used for ‘workplace’ related risk assessment
such as health and safety analysis, when the
assessment is performed by a ‘competent’
person aware of the methods and the risks and
with the responsibility to do it.
MN 5508 Project Management Module

Quantifying Risk
MN 5508 Project Management Module

Types of risk
• Strategic risk
• Compliance risk
• Operational risk
• Financial risk
• Reputational risk

http://business.tutsplus.com
 MN 5508 Project Management Module

Strategic risk

• Is the business/project technologically vulnerable?

• How dependent on material cost is the business/project?
• If our product/service vanished, would it matter?
• How dependent on price is the business/project?
• Are our methods, ethos, processes, ideas etc old fashioned?

……..Etc!
 MN 5508 Project Management Module

Compliance risk

• What new regulatory conditions are there?

• Has the business/project complied with relevant regulation?
• What would be the penalty if we had missed a regulation?
• Are any boundaries crossed if more people are employed?
• Are there any governmental (ie political etc) threats that will effect the
business/project?

……etc.!
 MN 5508 Project Management Module

Operational risk

• Are the systems/processes that the business/project uses reliable?

• Are the any dependencies on supply that might be a threat (eg power)?
• Is there a vulnerability to human error?
• What natural events might influence the business/project?
• Are there any key employees?

…..etc.!
 MN 5508 Project Management Module

Financial risk
• What if assets became worthless (eg a debtor failed)?
• What if debtors were late paying?
• What if interest rates increased?
• Is there any headroom to obtain new loans (ie gearing)?
• Will exchange rates have a major effect?
• Is there an agreed financing package for future business?

…..etc.!
MN 5508 Project Management Module

Financial risk…..more
Financial risk and its modelling is a sophisticated field with
many rivals. The ‘holy grail’ is to replace the ‘holistic’
judgement of individuals with a model fed by past data.

Caution! ‘Black Monday (or Tuesday!)’ in 1987 partly was

caused by rapid selling of stocks by programmes executed by
the recently launched computer trading systems. The
programmes sold stock when the stock price dropped below a
pre-set amount……
 MN 5508 Project Management Module

Reputational risk

• What would happen if there was ‘bad publicity’ from an important media (eg
magazine article)?
• What would happen if an employee was involved in a scandal?
• Are there any risks from lawsuits from suppliers, clients or others?
• Does the business/project team take steps to analyse publicity and manage impact?
• What would happen if there was bad publicity on social media?

….etc.!
 MN 5508 Project Management Module

Estimating risk
This model can be used to focus thought and analysis on the issues across a project or
business. Items can be ‘scored’ as to their likelihood on a subjective scale, for example:
1 Extremely unlikely
2 Unlikely
3 Possible
4 Likely
5 Extremely likely
Similarly, a score can be applied to the impact of each in the same way so that the position
of the issue on the risk consequence chart can be identified….and appropriate management
action decided upon.
 MN 5508 Project Management Module

The Odds
What are the chances of the Ace of Spades being turned up in a randomly shuffled 52 deck
of playing cards? 1 in 52

How many shuffles and re-deals would be necessary in theory to GUARANTEE that this
card would turn up at least once?
52

So if I shuffle and deal once and it does not turn up, does this mean that there is an
increased chance of it turning up next deal?
No, each deal has
the same chances!

So care is necessary using odds – probability – based methods. These are based on you being
able to re-run the scenario many times and then have a statistically based assessment.
 MN 5508 Project Management Module

What is Gambling? An aside!

‘Standard’ definition ‘Take risky action in the hope of a desired result [Oxford
Dictionary]’ or ‘Betting (wagering) that must result either in a gain or a loss
[Business Dictionary]’.
On this basis, the investor who invests £1m in a business must be a gambler since
there is risk and an uncertain outcome…..so are all business people gamblers?
How about ‘Knowingly taking a needless risk [Hervey, Bridge Players Bedside
Book]’?

Whatever the definition, in this module we are distinguishing between taking risks
that are ‘not necessary’ and endeavouring to gain information to lead to decisions
that ‘are necessary’ to continue progress! We do not prescribe to ‘luck’ as a
management tool!
 MN 5508 Project Management Module

Basic ways to assess risk

• Holistic judgement
• Precedence
• Modelling
 MN 5508 Project Management Module

Holistic Judgement
This is not strictly quantifying risk…it is decision making based on subjective experience and
availability of relevant facts.
It is what professionals gain as they progress through their careers, and as time goes on,
they are able to take decisions based on their amassed knowledge that are credible and
more likely to be correct.
They may not be able to explain WHY a decision is the right one to make (or at least of a
choice which is the best) but if pressed could relate it to other similar situations in their
experience.
Typical examples include Health and Safety risk assessment, some marketing investment
decisions, political decisions, military decisions etc.

Some would call this ‘gut feeling’ or ‘entrepreneurialism’ and good exponents
would probably have leadership qualities. Examples include Richard Branson,
Winston Churchill, General Eisenhower.
We will not presume to have such an expert to help us, so will not rely on
such ‘Holistic Judgement’ beyond that we are able to apply ourselves!
 MN 5508 Project Management Module

Precedence
If there have been enough relevant and recorded occurrences of our problem before, then
we might have available data to form a decision.
Example: A hat company wishes to launch a new range of hats. It has designed the hats and
the size ranges and is about to launch the product through advertisements etc. It is
concerned about running out of stock and needs to decide how many of each hat size to
make to minimise the chances of no-stock.

Fortunately the company has manufactured hats for decades and knows how many of each
size that it historically sells (ie not makes)….so it can directly assess how many hats to make
in this new range to match its market…..this is a direct comparison that is probably as
accurate to predict the future for as any other method…….head sizes tend not to change
much!
 MN 5508 Project Management Module
Suppose the manufacturer had not made hats before, so it did not have access to historic
data. It could either conduct a survey to measure a ‘representative number’ of people and
find out what the distribution was, or base a decision on published data. It is likely that the
data will be of the form:

Mean

Number at A ‘normal’
hat size distribution, the
Standard outcome of many
deviation statistical
assessments

Hat size
 MN 5508 Project Management Module

Uses for precedence based

assessments
 MN 5508 Project Management Module

Insurance
A 20 year old man was quoted £2500 premium to insure a car.
The same car was quoted at £350 for his 50 year old father:
the accident and claims statistics show that 50 year olds are
significantly less likely to have accidents that 20 year olds! It
doesn’t matter that his father was short sighted
and with slower reactions…..!
A 60 year old man was quoted a purchase price of £100,000
to buy an annuity (a guaranteed income for life) of £4500 per
year. If he dies younger than 86 years of age, the insurance
company gain, if he live past 86 he gains! The statistics on
mortality are very clear!
How does an insurance company decide how much premium to
charge for insuring a building in an earthquake zone against
collapse?! This is more likely to be a holistic judgement!
 MN 5508 Project Management Module

You are about to send a customer a new software programme

and information that packaged up is worth £2500. You will
send it letter post and can get it insured for £5. Do you
insure it?

According to the ‘Daily Mail’ Royal Mail lose or have

substantially delayed 0.07% of letters. There is therefore a
0.07% chance of loss or long delay. 0.07% of £2500 is
£1.75…..
 MN 5508 Project Management Module

Risk and people

Many of the methods and approaches we have discussed have relied on judgement of some
sort. Data based risk management is more analytical and objective, but often harder to
source data for.
Judgement is a result of experience in an appropriate field, and also personal approach! So
awareness of psychology is an important aspect of risk management……..

We will comtemplate psychology later!